feat: add API benchmark suite

.github/workflows/benchmark.yml

@@ -0,0 +1,43 @@
+name: API benchmark smoke
+
+on:
+  pull_request:
+    paths:
+      - "apps/api/**"
+      - "benchmarks/**"
+      - "package.json"
+      - "package-lock.json"
+      - ".github/workflows/benchmark.yml"
+  workflow_dispatch:
+
+jobs:
+  benchmark-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Start API
+        run: |
+          npm run start -w apps/api > api.log 2>&1 &
+          echo $! > api.pid
+          for i in {1..30}; do
+            if curl -fsS http://127.0.0.1:4000/health; then
+              exit 0
+            fi
+            sleep 1
+          done
+          cat api.log
+          exit 1
+      - run: npm run benchmark:smoke
+        env:
+          BENCHMARK_BASE_URL: http://127.0.0.1:4000
+          JWT_SECRET: development-secret
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: benchmark-results
+          path: benchmarks/results/

apps/api/package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "node src/server.js",
     "start": "node src/server.js",
-    "test": "node --test src/tests"
+    "test": "node --test \"src/tests/*.test.js\""
   },
   "dependencies": {
     "cors": "^2.8.5",

benchmarks/README.md

@@ -0,0 +1,22 @@
+# API Benchmarks
+
+Run the full benchmark suite against a local or staging API:
+
+```bash
+cp benchmarks/.env.benchmark.example benchmarks/.env.benchmark
+npm run benchmark
+```
+
+Run the low-cost smoke gate used by CI:
+
+```bash
+npm run benchmark:smoke
+```
+
+The suite covers every current `/api/*` route, including the admin route with a dedicated benchmark JWT. Configure `BENCHMARK_AUTH_TOKEN` if you want to supply a token explicitly, or let the runner generate one from `JWT_SECRET`.
+
+Smoke mode uses a small fixed request count per endpoint so CI verifies coverage, report generation, and threshold behavior without exhausting the API's default rate limiter. Full mode uses duration-based load for local and staging baselines.
+
+Results are written to `benchmarks/results/` as timestamped JSON and Markdown files plus `latest.json` and `latest.md`.
+
+Thresholds live in `benchmarks/thresholds.json`. Each endpoint is compared against p99 latency and error-rate limits so regressions are reviewable in pull requests.

benchmarks/endpoints.mjs

@@ -0,0 +1,168 @@
+const multipartBoundary = "----freelanceflow-benchmark";
+const multipartBody = [
+  `--${multipartBoundary}`,
+  'Content-Disposition: form-data; name="file"; filename="benchmark.txt"',
+  "Content-Type: text/plain",
+  "",
+  "Benchmark upload payload for API smoke tests.",
+  `--${multipartBoundary}--`,
+  ""
+].join("\r\n");
+
+export const endpoints = [
+  {
+    name: "auth.register",
+    method: "POST",
+    path: "/api/auth/register",
+    json: {
+      email: "benchmark-register@example.com",
+      password: "BenchmarkPass123!",
+      role: "client"
+    }
+  },
+  {
+    name: "auth.login",
+    method: "POST",
+    path: "/api/auth/login",
+    json: { email: "benchmark-login@example.com", password: "BenchmarkPass123!" }
+  },
+  {
+    name: "auth.oauthCallback",
+    method: "GET",
+    path: "/api/auth/oauth/github/callback"
+  },
+  {
+    name: "auth.refresh",
+    method: "POST",
+    path: "/api/auth/refresh",
+    json: {}
+  },
+  {
+    name: "users.list",
+    method: "GET",
+    path: "/api/users"
+  },
+  {
+    name: "users.create",
+    method: "POST",
+    path: "/api/users",
+    json: {
+      email: "benchmark-user@example.com",
+      name: "Benchmark User",
+      role: "freelancer",
+      skills: ["node", "api", "testing"]
+    }
+  },
+  {
+    name: "jobs.list",
+    method: "GET",
+    path: "/api/jobs"
+  },
+  {
+    name: "jobs.create",
+    method: "POST",
+    path: "/api/jobs",
+    json: {
+      title: "Benchmark API performance project",
+      description:
+        "Synthetic benchmark job payload that resembles a small production freelance project.",
+      budgetMin: 100000,
+      budgetMax: 125000,
+      categoryId: "cat_benchmark_engineering",
+      skills: ["node", "express", "performance"]
+    }
+  },
+  {
+    name: "proposals.list",
+    method: "GET",
+    path: "/api/proposals"
+  },
+  {
+    name: "proposals.create",
+    method: "POST",
+    path: "/api/proposals",
+    json: {
+      jobId: "job_benchmark",
+      freelancerId: "usr_benchmark_freelancer",
+      coverLetter: "I can benchmark and optimize this API surface.",
+      bidAmount: 120000
+    }
+  },
+  {
+    name: "payments.create",
+    method: "POST",
+    path: "/api/payments",
+    json: {
+      amount: 2500,
+      currency: "usd",
+      metadata: { benchmark: "true", jobId: "job_benchmark" }
+    }
+  },
+  {
+    name: "reviews.list",
+    method: "GET",
+    path: "/api/reviews"
+  },
+  {
+    name: "reviews.create",
+    method: "POST",
+    path: "/api/reviews",
+    json: {
+      jobId: "job_benchmark",
+      reviewerId: "usr_benchmark_client",
+      subjectId: "usr_benchmark_freelancer",
+      rating: 5,
+      comment: "Fast, clear, and reliable delivery."
+    }
+  },
+  {
+    name: "messages.list",
+    method: "GET",
+    path: "/api/messages"
+  },
+  {
+    name: "messages.create",
+    method: "POST",
+    path: "/api/messages",
+    json: {
+      fromUserId: "usr_benchmark_client",
+      toUserId: "usr_benchmark_freelancer",
+      body: "Can you share a benchmark summary by Friday?"
+    }
+  },
+  {
+    name: "notifications.list",
+    method: "GET",
+    path: "/api/notifications"
+  },
+  {
+    name: "notifications.create",
+    method: "POST",
+    path: "/api/notifications",
+    json: {
+      userId: "usr_benchmark_client",
+      type: "benchmark",
+      message: "Your benchmark report is ready."
+    }
+  },
+  {
+    name: "uploads.create",
+    method: "POST",
+    path: "/api/uploads",
+    body: multipartBody,
+    headers: {
+      "content-type": `multipart/form-data; boundary=${multipartBoundary}`
+    }
+  },
+  {
+    name: "search.global",
+    method: "GET",
+    path: "/api/search?q=benchmark%20developer"
+  },
+  {
+    name: "admin.metrics",
+    method: "GET",
+    path: "/api/admin/metrics",
+    auth: true
+  }
+];

benchmarks/results/.gitkeep

@@ -0,0 +1 @@
+